Metinfo Cms CVE-2026-29014

No special conditions — remote unauthenticated exploitation against MetInfo CMS versions 7.9, 8.0, and 8.1. Attacker sends crafted HTTP requests containing malicious PHP code to vulnerable input parameters. No authentication, user interaction, or special configuration required.

Despite the absence of CVSS scoring data, this vulnerability carries extremely high real-world risk. The combination of unauthenticated access (no authentication required per description), publicly available exploit code, and PHP code injection leading to remote code execution (RCE) creates an immediate and severe threat. The attack vector is network-based with low complexity-attackers only need to craft and send HTTP requests. The technical impact is critical: full server compromise with arbitrary code execution. Under SSVC framework, this would be classified as having high exploitation likelihood (public POC exists), automated exploitability (no complex multi-step interactions required), and maximum technical impact (remote code execution). The lack of CVSS score does not diminish the severity; rather, it reflects this CVE's recent disclosure or pending official analysis. Organizations should treat this as critical priority regardless of missing CVSS data.

An attacker identifies a MetInfo CMS 8.0 instance exposed on the internet and sends an HTTP request to a vulnerable endpoint with a crafted payload containing malicious PHP code (e.g., '<?php system($_GET["cmd"]); ?>'). The application's insufficient input validation fails to sanitize the injected code, and the PHP engine executes it directly. The attacker gains immediate remote code execution, creates a web shell for persistent access, and can then exfiltrate database credentials, modify site content, or pivot to internal network systems. Publicly available exploit tools automate this process, allowing attackers with minimal skill to compromise vulnerable instances at scale.